Using tfsec to Scan Your Terraform Code

As more and more teams are using infrastructure as code to ensure they have consistent, repeatable deployment of infrastructure, it is becoming increasingly important to guard against mis-configurations creeping into the release.
This talk will cover using tfsec to scan .tf and .tf.json files for such issues. It will also cover using the the tfsec VSCode extension and GitHub actions to shift left and catch issues early.
Rough breakdown:
- Introduction to why tfsec exists and the background - 5 minutes
- Scanning your files - with demo
- tfsec advanced features - 10mins
- Custom checks - satisfying your companies compliance requirements
- Ignoring checks - expiry, workspace filtering
- Shifting left - 10mins
- VSCode extension
- GitHub actions
- Questions - 5mins
The attendee will leave with an understanding that there are risks to misconfiguration and they will learn about a tool that can support them. Even if they go on to use another static analysis tool, they will have been prompted to be more vigilant.
Speaker: Owen Rumney
GitHub: @owenrumney
Twitter: @owenrum
If you liked this video and want to see more from HashiCorp, subscribe to our channel: www.youtube.co...
To learn more, visit our hands-on interactive lab environment, HashiCorp Learn: learn.hashicor...
HashiCorp provides infrastructure automation software for multi-cloud environments, enabling enterprises to unlock a common cloud operating model to provision, secure, connect, and run any application on any infrastructure. HashiCorp open source tools Vagrant, Packer, Terraform, Vault, Consul, Nomad, Boundary, and Waypoint allow organizations to deliver applications faster by helping enterprises transition from manual processes and ITIL practices to self-service automation and DevOps practices.
For more information, visit: www.hashicorp.com or follow us on social media:
Twitter: @hashicorp
LinkedIn: / hashicorp
Facebook: / hashicorp